CVEs published July 17, 2019
68 CVEs were published on July 17, 2019: 1 critical, 3 high. 1 is now in CISA KEV.
- Published
- 68
- Critical
- 1
- High
- 3
- Medium
- 12
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- Comodo Antivirus
- 5
- IBM QRadar SIEM
- 4
- Cisco Identity Services Engine Software
- 2
- Document Foundation LibreOffice
- 2
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
- The Eclipse Foundation Eclipse OpenJ9
- 2
- Cisco Aironet Access Point Software
- 1
- Cisco FindIT Network Manager
- 1
- Cisco Industrial Network Director
- 1
- Cisco Small Business 300 Series Managed Switches
- 1
Critical 1
High 3
- CVE-2019-1919Cisco FindIT Network Management Software Static Credentials VulnerabilityCisco FindIT Network Manager
- CVE-2019-1920Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2019-13272In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to cre
Medium, low and unrated 64
- CVE-2019-5222There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216Honor Magic
- CVE-2019-13640In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shel
- CVE-2019-3973Comodo Antivirus versions 11.0.0.6582 and below are vulnerable to Denial of Service affecting CmdGuard.sys via its filter port "cmdServicePoComodo Antivirus
- CVE-2019-3972Comodo Antivirus versions 12.0.0.6810 and below are vulnerable to Denial of Service affecting CmdAgent.exe via an unprotected section objectComodo Antivirus
- CVE-2019-3971Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to a local Denial of Service affecting CmdVirth.exe via its LPC port "cmdvrtLPCSeComodo Antivirus
- CVE-2019-3970Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Arbitrary File Write due to Cavwp.exe handling of Comodo's Antivirus database.Comodo Antivirus
- CVE-2019-3969Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Local Privilege Escalation due to CmdAgent's handling of COM clients.Comodo Antivirus
- CVE-2019-1010263Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control.Perl Crypt::JWT
- CVE-2019-1943Cisco Small Business Series Switches Open Redirect VulnerabilityCisco Small Business 300 Series Managed Switches
- CVE-2019-1923Cisco Small Business SPA500 Series IP Phones Local Command Execution VulnerabilityCisco SPA525G2 5-line IP Phone
- CVE-2019-1010266lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption.lodash · lodash-es +2
- CVE-2019-1940Cisco Industrial Network Director Web Services Management Agent Unauthorized Information Disclosure VulnerabilityCisco Industrial Network Director
- CVE-2019-1941Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2019-1942Cisco Identity Services Engine Blind SQL Injection VulnerabilityCisco Identity Services Engine Software
- CVE-2019-12913Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.
- CVE-2019-13637In LogMeIn join.me before 3.16.0.5505, an attacker could execute arbitrary commands on a targeted system.
- CVE-2019-11772In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null The Eclipse Foundation Eclipse OpenJ9
- CVE-2019-11771AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.The Eclipse Foundation Eclipse OpenJ9
- CVE-2019-12912Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.
- CVE-2019-1010275helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation.helm · helm.sh/helm
- CVE-2019-8931Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.
- CVE-2019-8932Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the appl
- CVE-2019-12914Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the appl
- CVE-2019-12911Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the appl
- CVE-2019-1010283Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure.Univention Corporate Server univention-directory-notifier
- CVE-2019-13636In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files.
- CVE-2019-1010287Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS).Timesheet Next Gen
- CVE-2019-12876Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege
- CVE-2019-11535Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote comm
- CVE-2019-13619In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash.
- CVE-2019-13447An issue was discovered in Sertek Xpare 3.67.
- CVE-2019-13448An issue was discovered in Sertek Xpare 3.67.
- CVE-2019-13493In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager.
- CVE-2019-13577SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote fea
- CVE-2019-13584The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request.
- CVE-2019-13585The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request.
- CVE-2019-13631In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID repo
- CVE-2019-13614CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and earlier is prone to a
- CVE-2019-13613CMD_FTEST_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 20180502 rel.45702 (EU) a
- CVE-2019-12175In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser
- CVE-2019-1010091tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.tinymce
- CVE-2019-13346In MyT 1.5.1, the User[username] parameter has XSS.
- CVE-2019-12475In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
- CVE-2019-13403Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of
- CVE-2019-13573A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress.
- CVE-2019-10352A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.jJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-10353CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-10354A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fraJenkins project Jenkins · org.jenkins-ci.main:jenkins-co… +1
- CVE-2019-13453Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service.
- CVE-2019-4430IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system.IBM Maximo Asset Management
- CVE-2019-4211IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2019-4194IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authoIBM Jazz for Service Management
- CVE-2019-4054IBM QRadar SIEM 7.2 and 7.3 could allow a local user to obtain sensitive information when exporting content that could aid an attacker in fuIBM QRadar SIEM
- CVE-2018-2022IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users.IBM QRadar SIEM
- CVE-2018-2021IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2018-1921IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting.IBM Campaign
- CVE-2019-1010083The Pallets Project Flask before 1.0 is affected by: unexpected memory usage.The Pallets Project Flask · flask
- CVE-2019-1010084Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control.Dancer::Plugin::SimpleCRUD
- CVE-2019-9849LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources.Document Foundation LibreOffice
- CVE-2019-9848LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-ovDocument Foundation LibreOffice
- CVE-2019-13625NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
- CVE-2019-13624In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings tha
- CVE-2019-13623In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with
- CVE-2019-13626SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in